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This Reply Brief is being filed within two (2) months of the mailing of the Examiner's Answer mailed 
on 04/27/2007. 

Following is an issue-by-tssue reply to the Examiner's Answer. 



The rejection of Claims 2, 18, and 34-37 wider 35 U.S.C, 112, second paragraph has been 
withdrawn by the Examiner. 

Issue #2: 

The Examiner has rejected Claim.-. 1-2 4-13 P-ks 20-29, * M5 iS-40 42 and 44 under 35 I'SC 
? 02(e) as being anticipated by Giupe et a! M - ^ Publication No 2002 0^4212) 

Group ill: Claims I, 4-7 <>-//, IS /" 2"-2S 25-2 :>K S3, Jo and 42 

The Examiner has relied on Paragraphs 0008, and 000° rium (mrpe to meet appellant's claimed 
technique "wherein the scanning co-prucesioj ^ i mtet the eomiol of the cenuni processing tmu a fa 
the execution of the scanning contiol Some b\ tlu central processing unif t >ee th!» u\ smnLn. but 
not necessarily identical language tn the independent Claims 1. P, and ^} 



product cc:v;ps:i.i.i.j':v! a computer program operable to control a scanning 
computer to produce a log file identifying computer data from a source 
computer having specified content, .s.sii.d cotiiputfc r. o;. rgr ^oiis&cisirqf: 



s>.\a':.k ime, .i.ucn a.-s ov^ni^ight or. d\xzi.r-.<s ;:bts i-er\d . To address this 
problem embodiments of the invention transfer data to be scanned from a 
source computer to a scanning computer . The scanning computer then scans 
the data and creates a log file identifying portions of the data that have 
predetermined characteristics indicating a particular specified content. 



Appellant respectfully asserts that the excerpts from Grupe relied upon by the Examiner merely 
disclose "a computer program operable to control a scanning computer to produce a log file 
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i dent Using computet data Uom a souice computet Immg specified content * Fnrihet, untpe 
discloses that \teui to be scanned [is ttansfetted* Uom a source computer to a scanning computet ' 
wheie 1 (rilie scanning computet then scans the data and cteaies t j log Hie uientifsing portions ot the 
dam that ha\c predetcsmmed chaiaeteitsties indicating a patticuidt specified content (emphasis 
added ) 3: loue't er, the mere disclosure oi tidiisienmg data fium a -ouice computet to a -.canning 
computet where the scanning computer scans the data and create^ a log file a-, in (mrpc fails to 
esen suggest a technique 'whet em the scanning vO-ptocessot is under the contioi of the centiai 
processing unit a la the execution of the scanning control logic bs the central pioeessmg unit 
tetnphasis added) a< claimed hs appellant ( ieails, since the scanning computet disclosed b\ 
(Snipe is not under the cotttiol ol the souice computet then (ittipe tails to disclose \\heiem the 
scanning co-piocessot is nndei die comiol of the centtal ptocesstng unit \ ta the execution of the 
scanning connol logic In the icntmi processing unit ' (emphasi-- added} a o claimed b\ appellant 

In the 1 xaminet s Ans\\et dated 04 2"* 20U~ the Lxammer has digued that * jtjhe -.ending of data 
fiom the source compute] {i e the centtal pioces-ang unit) to the scanning eomputtr 0 e the co- 
process; u i is an uistniction to scan the data sent x-cause the scanning computet scans the data as the 
next step after tecen mg the dam " I he t vmunei has fuithei stated that 1 [s]mce the scanning 
compute! is mstnicicd b\ the source computer to scan the data horn flhej somee computet it rs 
under the contioi oi the souice computet ' 

\ppe11ant tespecttulK disa^tees and notes that Grupc tneielx discloses a * uanstei [of] data to be 
scanned ftom a ^outce cornputei to a scanning computer* and that the it jhc ^canning compute! then 
scans the data" (emphasis added) } lowesei meiels ttansterrmg data ftom a souice eomputer to a 
scanning computet w here tt is then scanned as in uiupe does not teach a tedinujue v, bet em the 
scanning co-ptocesooi is undei the conttol of the centtal piocessmg unit s sa the execution of the 
scanning control logic b\ the cential processing ami {emphasis added) as claimed bv appellant 

1 urtheimoie the I: vnmnei has lehed on Paiagutph 00U°- ftom diupe to make a prior ait showing ot 
appellant s claimed icchnujue 'whet em additional data to be scanned In the scanning co-piocessot 
is queued while waiting rot the results horn the ^canning co-ptoccssot" Uee tins ot similar, but not 
nece^saulv identical language in the independent Hatms 1 1 ~ and ^) 
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probleir embodiments of the invention transfer data to be scanned from a 
source computer to a scanning computer The scanning computer then scans 
the data and creates a log file identifying portions of the data that have 
predetermined chttractexi&tics indicating a particular spycxtied. content. 



VppJIant icspeuUiih assufs that the exceipt ijom Uiupe relied upon h\ the i vamnu much 
discloses that ' data to bo scanned [b nansfutcd irom a souiec computet to a scanning computet 
wheie "{{.he ->eannnui compute! then scans the data and eicaiea <i lou tile idenUhmg portions of {he 
data that have piedolemuned ehafaetejisues indicating a patliculai specified content (emphasis 
added* llov\e\ei the nieit disclosing that the data to be canned is translated n the scanning 
computei \v here the scanning computer then scans the data and cieak\s a log file as m Gmpe, tails 
to e\en suggest a technique ~\\heiem additional data to he sc armed hv the sc wrung eo-pj ocelot is 
queued while \\ aum.u fui the iesulN hum the scanning cu-pioees*of (emphasis added) as churned 
bv appellant C leaf K ttansK mng the data to he scanned ,nu\ then scanning the data as m iirupe 
tails to suggest ' [ queuing ] addition \\ data to he scanned wiide waiting foi the tesults from the 
scanning co-ptocessor LmphaMs added) as claimed b\ appellant 

In the f \aimnei s \nsv\oi dated 04 C" 7 200"" tiie Fxaimnei ha-, fwthei lehed on Paiagiaph 00 ^ 4 ol 
drupe and has argued that ' drupe discloses th,. files are sent and scanned b\ the canning compute! 
ami onct all the files ha\e been scanned the log is sent to the -omce cempmu The txarmner has 
fiuthei stated thai "[tjhuefote the ille-. that ha\c \e{ to be scanned ate sioied while watting ioi the 
tesults lx\au>e {he results ate not >ent until all o, the data ha-- been scanned 

appellant respeufulh disagrees, with the hxammef s allegations, and asserts that the exceipt Irom 
(nitpe tcliedon h\ the F\ammet meteK teat he\> that all of the file- hum |aj viSumc of the main 
computei aie copied to a scanning computet " and that "[ijhe scanning computer then scans the 
copied files { Patagtaph 00v4 emphasis added) i utthei drupe discloses thai \\\ jhen ail the 
copied files ha\c been ^canned the log file is sent back to the main eemptitu iPataataph 00 * 1 
emphasb added) Hove\ei meieix cops mg all files to a scanning computei scanning ail copied 
files and sending a log back to a main computei aftet ail files have been scanned , as m drupe, does 
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not teach a technique '\\hetem t )dd!tHin.il data to be scanned In the ocannmg co-pmccssot ^ queue 
whsie \\aitimjJoi the iesuks i'som the scanning o-proccssoi % i emphasis added), as churned bv 
appellant < learh cops mg the xlies to a scanning computet and then scanning the copied files as 
in Gtupe, simpK fatL to even suggest that " additional data to be scanned is queued v\ Side waitm. 
ibi the tcsults ' {emphasis added), in the marmot as claimed hv appellant 

I he L\ainmer is reminded that a claim is anticipated onh if each and eveiv element as set foith m 
the claim is found cube; e\pressl\ oi tnheienth desenbed m a single pnoi art icfetence J ctfLgji 
/fms \ I ttmtt <hi ( c ()f< jittotti.it, SI4 r 2d 628, n*I 2 1 Sl'Q2d lO^i 10S^ (I ed t u l 1 ^" 7 ) 
MoieoAei the identical invention must be shown m as complete detail as contained in the claim 
Rh/uuho/n Sicukf \h»<» { '<> fcotf F 2d I22(x 1236, ^I'SPtXd l°B w:0(hed(u l^>i I he 
elements must be at tanged a.-> lequned hs the claim 

This auction has stmph not been met b\ the Gtnpe lefcienee, espeaalh m v lew ol the aiguments 
made hereinabove. 

Group fi-2: Claims 2 and 18 

The Examiner has relied on Paragraph 0015 from Grupe to make a prior art showing of appellant's 
claimed "processing the data utilizing the central processing unit upon the receipt of favorable 
results from tlie scanning co-processor including a situation where malicious code is not detected.''" 




m ^ t , ^ > _ log reading logic 

operable to control said source computer to read a log file written by a 
scanning computer, said log file identifying portions of said computer 
data having said predetermined characteristics; and response logic 
responsive to said log file and operable to control said source computer 
to perform further processing tasks upon at least said data identified in 
said log file as having said predetermined characteristics." i Paragraph 

Appellant respectfully asserts that the excerpt from Grupe relied upon by the Examiner merely 
discloses that "log reading logic [is] operable to control, said source computer to read a log file 



wntten h\ a scanning, computet [uheie] said log file tdentifjjes] pott tons of said computet data 
ha% mg said piodeleimmed ehaiaaeii sties" temphasts added} Futthei Giupe discloses that "s<nd 
sottice computet peilormjs] futthei processing tasks upon at least said data identified m \an\ loc 
file as ha\ in a said ptedcter mined characteristics (emphasis added j Ho^ ev ei tbv meic disdosutt 
ot peifotmmg hmhet ptocesstng tasls upon a log file which identities pott tons ot computet data 
having pSv.daerm.med chaiactenstsv.s as m (mm.' laih to s .\ai suggest 'piocessmg the data 
ulih/ina the cential ptneessing unit upon the uceipt oi fav oiabie result' front the -.canning co- 
processor including a situ uion w hetc mai cious code is not detected (emphasis added) as eia med 
by appellant. 

In the Office Action mailed 05/01/2006, the Examiner argued that "the log file allows the user to 
asccmun which data ts mahctouo {needing le-sc^nning.) and v jt]heotbei data is clean ' Appellant 
tespcctfulk disagices and asserts that Gtupc meieh discloses that" said log File uicntifftesi pouton^ 
ot f.nd computet dat.t ha\ tug satd pi edetei mu ted ch.uac tei istic a " temphasts added) Cleat ly 
idcntifv poittons of computet data hawng picdeteimmtd «_hataeteustics. as m Giupe. fads to 
even suggest 'the teceipt of tavotable tesults tiom the ,->cannmg eo-piocessoi meiudim; a situation 
where malicious code k not detected {emphatic added > as claimed b\ appellant 

In the 1 xaminet s AtiMvct dated 04 2" 200" the Lxannnei has furthei relied on Paiagiaph 00^0 oi 
Guipc and lias assorted that "|w]hen the li\e svstem tecenes the log file containing alkst of mllcted 
tiles, am file that is not on the list has favorable lesult;. I lie hvmunet hu> furthei stated that 
'[tjhetefote when the files copied fiom the lt\e astern to the backup system ate the complete set ol 
hies stored on the compute! (see paiagiaph [00 I j) the Files not m the log File would be utth/ed as 
normal bv the live system." 

Appellant icspecttuSh disagiees and note> that the above exeeipts fiom Grupe tehed on h> the 
Fvtmtnei meteh teach that * a copv of the live data on a "itse" system ts sent to a ha el up 
svstcm { Pat auuph 0(H0) I he e^eipts funhci teach that "itjht backup s\ stem then s L a ns the 
copied data tot predctet m med chat acte; tstics cieutes a log tile and writes details of such data 
to the log file [and] sends the log file back to the live system" < Patagiaph OQ^O) Futthet the 
exeeqtts teach that '[tjhe hse svstem then scans any live data that is indicated in the log file " 
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(Paragraph [00 ^0] - emphasis added), where "said log Hie identifies] portions of said computer 
data having s^ (Pat agi apli 00 ) 5 emphasis added } 

However, appellant points out that simply nowhere in the above excerpts from Grupe relied on by 
the rxammet is it taught that ' an\ Hie thai is not on the list has favorable tesulb " as alleged b\ the 
Fvammei The above exceipts teach that sa>d log file idenufjie^ poitions of said computet data 
having said pi edetei mined charactensucs ' and thereto! e, anv poi turns' o{ compute! data not on the 
list simph do not have the predetermined chatacteustics that the backup swem warmed tot 

1 uidici iiietelv scanning copied data for piedcteimmcd chaiacler isms creating and sending a U>g 
file and scanning data indicated tn hV lug file that has the pi edetei mined chatactenstics as m 
Gtupe simph fails to even suggest 'the lecespt oi faunabie a-suits from the scanning co- 
processor " much less 'processing the data utilizing the centiul piocessin» unit upon the icceipt of 
favorable results from the scanning eo-piocesooi me hiding a situation wheie malicious <.ode is not 
detected' (emphasis added) as claimed b\ appellant ( leatlv a log file containing details of data 
\v ith piedetermmed characteristics as m ( Snipe, simph fails to suggest the icceipt of favor able 
lestiits fiom the scanning eo-psoccssor including a situation wheie malicious code is not detected 
f emphasis added), m the manna as claimed b\ appellant 

Again appellant iespeufulb asserts that appellant s specific claim lanuuaue is not anticipated In the 
Grupe reference since all of appellant's claim limitations have not been met by the Grupe reference, 
as noted above. 

Group US: Claims S and 24 

The Examiner has relied on Paragraphs 0010 and 00 11 in Grupe to make a prior art showing of 
appellant's claimed technique "wherein the event is initiated under the control of the scanning 
control logic." 

*■ , t - , it is preferable that the computer program 

product comprises log transferring logic operable to control said scanning 
consputer to transfer said log tile , via a network connection to said 
source computer. 
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\ppellam jesptcttulK a^em that log ttanstertnig logic [s-] opeuible to cvnn^i said scanning 
computet to uanstei said log ft It. \ la a netw oik. connection 10 *>aul stmitc computet* (emphasis 
added} Hu\se\er the mere disclosure that log tiamfeinug logic uansfets the lag Isle hum the 
scanning computer tt) iIk soiuee computet fails to e\en suacest a technique h huem the e\ ent is 
initiated under the contiul ot the canning eonttol logic (emphasis added) as- claimed b\ appelant 

in the F \atntner s \iu^\ct dated 04 2"* 2(H)" the i \aimnei has funhci tehed upon Patagtapbs 001 s 
(K) 1 6 m (dupe and asserts that Gtupc discloses a computer program ptoduct comprising a 
compute! pjoiriain opeiable to control a souicc computet to <«.ar> compute; data (paragraph [00 1 s \) 
and a computet pt ^gram opeiable to conttui said source computer to tunsm.it at lean one iurthei 
'taction ot said data to at least one fuithei scanning computet (paragraph [001 1>\) Fuithet the 
f \amtnei ha^ atgued that (tjhetetote (uupe discloses initiatm*? an e\eni (the scanning oi data) 
eithei bs scanning the data rt&eif (paragraph [001 ^ j) ot -.ending u to a scaunniu computet tpaiagiaph 
'OOl'Oj using scanning eonttol logic (the computet prcgunn.) 

\ppellant tespectkiSh disagrees and rotes that as admitted b\ the I xaninici the e^ ent initiated m 
Ciiupe ss - the scanning ot data (emphasis added) I lowest initiating the scanning ot data does not 
teach and m tact /<. n/w>in< n from a technique whaein tin. e\ent k initiated under the contiol ot 
the -canning control logic (emphasis added) whete the ' en ent |ts initiated] based on the results 
horn the scanning co-ptocessor (emphasis added) as claimed b\ appellant 

\s a result contiol[ling] a soure* computes to sc.an.cotiiputei data stoicd bs said souice computer 

( Paragraph ooi s emph tsis added) and 'eontroMing' said souice computet to tiausmit at least one 
Umber traction of said data to at least one Hit the scanning computet ( Paragraph U01 n - emphasis 
added i do not teadt and m iact h Jtla \ Item a technique v heicm the e\ ent ts initiated undei 
the eonttol ot the scanning contioi logic (emphasis added) where the e\ ent [is initiated j based on 
the tesults ttom th. scanning eo-proce^sui ^emphasis added), ts claimed b\ appellant 



Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by the 

Grape reference since all of appellant's claim limitations have not been met by the Grape reference, 
as noted above. 

Group 1)4; Claims 1 2 am:} 28 

1 he Haminei Iun re hod *>n Piragraphs 00 1 1 and 0028 m Giupe to make a pnos ait ^hu\\ ma ^f 
appellant \-> dunned iedmujue 1 whet em utus siguatmes are stored in the mcmoiv 




ci content. As the network storage device 18 can be very large, 



the amount of processing time required to compare every stored file 
against an increasing number of virus definition profiles can foe extremely 




Appellant respectfully asserts that the excerpts from Grupe relied upon by the Examiner merely 
disclose that k '[a]s the network storage device I S can be very large, the amount of processing time 
required to compare ^ against m increasing number of virus definition profiles can 

be extremely long" (emphasis added). However, the mere disclosure in Grupe that the stored files 
are compared against an increasing number of virus definition profiles fails to teach a technique 
"wherein virus signatures are stored in the memory '' (emphasis added), as claimed by appellant. 

In the Examiner's Answer dated 04/27/2007, the Examiner has argued that "in order to make any 
type of comparison in a processor each value involved in this comparison must be stored in some 
type of memory because if both values were not stored, one value would not be available for 
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companion " The nxamtnei has further argued (hat "[ijhetefoje, when comparing (he fries against 
ujus definition profiles but!) the file and the definition profiles muvt be held m memofs 

\ppeiiant uspoctfuiK disagree.-, and points out that meiek alleging that it ss neccssan to moic iilos 
and "\ mi-> definition profiles in some tspe oi mcmois in oidei to tompaie them fads to (oath a 
technique 1 u herein v ntis signature^ aie stoied in (he momon ' t emphasis added), wheic the niemoix 
is included in "the scanning co-pux.essoi (emphasis added) m the context as claimed b\ appellant 
1 hiis, appellant again notes that the above cxceipts rehed on b\ the tvi miner fail to teach a 
technique heiein % tnis signatiues ate stoted in (he memou (emphasis added) as claimed bv 
appellant It thus appears that the h \arumet has snuph not considered (be full u eight of appellant s 
claims, 

\uam appellant respectfully asset ts that appellant s specdk chum language is not anticipated h\ the- 
Giupe lefeieuce since all of appellant's claim limitations ba\e nor been met b\ (he Giupc refeience, 
as noted above. 

Group US: Claims 34 and 35 

Furthermore, the Examiner has relied on Paragraph 0009 from Grupe to make a prior art showing of 
appellant's claimed "({netting additional data to be scanned by the scanning co-processor while 
waiting for the results from the scanning co-processor'' (see this or similar, but not necessarily 
identical language in the independent Claims 34 and 35). 




problem enibodimerifcs of the invention transfer data to be scanned from a 
source computer to a scanning computer. The scanning computer then scans 
the data and creates a log file identifying portions of the data that have 
predetermined characteristics indicating a particular specified content. 




Appellant respectfully asserts that the excerpt from Grupe relied upon, by the Examiner merely 
discloses that "' data to be scanned [ is transferred] from a source computer to a scanning computer" 
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where "[t'jhe scanning computer then scans.tju'.^ identifying portions of the 

data that have predetermined characteristics indicating a particular specified content"' (emphasis 
added). However, the mere disclosure in Gmpe that the data to be scanned is transferred to the 
scanning computer w her*, the scanning computer then scans the data and c teates a log file fails to 
even suggest ' queuing additional data tu be ^canned b\ the scanning eo~piocessoi while waiting ioi 
the results horn the scanning co-pioce>sot ' (emphasis added) claimed bv appellant Heath , 
tsansfcmni: the data to be scanned and then scanning the data as in dupe fails to suggest ' queuing 
additional data to be scanned while waiting fos the icsuits fiom the scanning co-piocessof 
(emphasis added), as claimed by appellant. 

In the Examiner's Answer dated 04/27/2007, the Examiner has further relied on Paragraph 0034 of 
Gtupe and has claimed that Gmpe disclose^ the files aie sent and scanned b\ the scanmna 
compute! and once all the tile* ha\c been scanned the log i- ~ent to the sOtiice computet " The 
Examiner has furthet stated that " jtjheiefoie the lile^ that ruue \et to be scanned aie stored while 
waning foi the iesnlts because the lesiihs are not sent until all of the data has been it a lined % 

\ppeilant lespeetfulK dioagteeo with the I \aminef s allegations and asserts that the exec-ipt irom 
Giiipe :eliedon h\ the Fsammei muel\ teache^that " ail of the tile fiom jaj ■umtmc of the mam 
computet aie copied to a scanning computet ' and that 'j tjhe scanning computer then scans the 
copied files {Paragraph 0034 emphasis added) Fuithei Grape discloses that 1 [w jhxn ail the 
copied tiles hax e been scanned the log file is sent back to the mam computet ' (Paiagiaph 00 M 
emphasis added) However met eh eop\tn&ali files tu a ^canning compute! scanning ail copied 
Hies and ^ending a log bad- to a main compute! aftct all files have been scanned as m Grupe, does 
not teach ' queuing additional data to be scanned b\ the scanning eo-piocessoi w Inle waiting tot the 
testtlts ftum the scanning co-piocessor " (emphasis added) as claimed b\ appellant Cleaih, copying 
the tiles to a -"canning computer, and then scanning the copied files, a* in Grape, simph *aih> to even 
suggest that ' queuing additional data to be scanred while waiting fur the iisults ' t emphasis 
added), in the manner as claimed by appellant. 

F utthet, the I vammei has telsed on Paragraph 001 s" from Gmpe to make a piioi an show mg ot 
appellant s claimed ' piocewng the data nnU/mg the central processing unit upon the receipt of 
faxoidblo rec-ults irom the scanning co~piocessoi including a situation where malicious code is not 
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detected" {.see this ot stmsiat but not tieeessauh identical language m the independent Claims 34 
and 35). 




.rp«:ci i con"^:r\i., aaia. cx^j'Er prrccjxa.:;: cc-mpr. i ;-:.l.r:0 : log reading logic 
operable to control said source coro.pu.tex: to read a log file written by a 
scanning computer, said log file identifying portions of said computer 
data having said predetermined characteristics; and response logic 
responsive to said log file and operable t.o control said source computer 
to perform further processing tasks upon at least said data identified in 
said log file as having said predetermined characteristics . " f Psra'jr-xpfc 

Appellant respectfully asserts that the excerpt from Grupe relied upon by the Examiner merely 
discloses that "log reading logic [is] operable to control said source computer to read a log file 
wntten bv^^^^^ [where] said !og.iil.e.j.dentij]_iesJ p 

basing said pxedeternm {emphasis added). Further. Grupe discloses that 'said 

sotsice computes peilormjs] fuithot processing, tasks upon at least said data identified m said log 
file as ha\ tng said predetermined characteristics " (emphasis added) Howex ei tfk meiv disclosinc 
of performing furthci ptotewng tasks upon a lot; file which identifies poHions of computet data 
haxmg piedeternmtied duiaaenstiv.>, as m (htipj lads to c\en suggest 'piocesMtig the data 
utilizing the cermal piocessing unit tipon the ueeipt of fau'tahie results front the .-.canning 10- 
ptocessot including a situation whete makcious iode is not detected (emphasis added) as claimed 
bv appellant. 

In the Office Action mailed 0* 01 2006 the \- \ammei has argued that the log file allows the uset to 
asvcuain wmch data is mahcioiio {needing le-st^nning) and v jt]he othei data is Jean Appellant 
icspcctftilK disagiees and asserts that Gtupc met eh discloses that" said log file utcrititjtesi portion^ 
ot >aul computer data ha\ ing said pi edetei mmcd char ac tci istic s (emphasis added) t leailv 
iduuif, nig poitions of computet data having picdettiimned chaiaetetisttcs lads to t '\eu suggest 'the 
receipt of fa\oiable u-suits ftom the ^canning co-proces:>oi including a situation wheie malicious 
code is not detected " (emphasis added) as claimed bv appellant 
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in the Fxatntnei's Aiu-wet dated 04 27 2(H)", the Fvimmei has furthci tehed on Paragraphs OOP 
and 00^0 oi Guipe and ha> araued that ' [w jheu the h\c sWccn recetses the log file containing a list 
of infected files ans tile fliat is not on the list has tavnable results " 1 he 1-\.ammei has fun her 
argued that ' [t]heiefoie w hen the files copied from the In c s\-tem to the backup s\ stem are the 
complete set of files stotedon the computet (see paiagiaph [0045 j) the fika not m the log file 
would be utilized a^ norma! bv the h\e ssstem 

\ppt'Uant tespecttulK dtsagtees and notes that die abo\c e\eetpts fiom (nupe tehed on h\ the 
Fvitmnei meteh teach that * a cop\ of the In e data on a "h\e" s\srcm ts sent to a backup 
s\ stem ' {Paiagiaph 0030) I he excerpts Umber teaeh that ' I t]he backup s\ stem then vans the 
copied data fot ptedetenmned diatacteiistics cieates a log file and wutes details of such data 
to the log file [and] ,->ends the log tlie back to the ls\e ss-tetrT ( Paiagiaph 00^0} I uithcr the 
exceipts teach that "ft] he h\e s\stem then scans ans in e data that is indicated in the log file ' 
f Paiagiaph jOO'H)] emphasis added) wheie \atd iog file uleiuifjtes] pott tons of said compute! 
data having; said pi edeleimmed characteristics' (Patagtapb OOP emphasis added} 

Howt-xci appellant points out that simpK nowlu-ie in the abo\e escespts fiom fiaipe tehed on bv 
the nxammet is it taught that v am Hie that ts not on the hst has fax urabic tetailb " as claimed bv the 
Fvammet 1 he abose excerpts teach that 1 saul log file tdentifjie c ] poittons of said computet data 
having satd pie Jeter mint? J characteristics ' thus, an\ poitions of computet data not the hst 
simph do not ha\e the pi edetcrmi ned chants tenst k $ that the backup s\ »tem scanned tor 

f uitliLi motels scanning copied data for piedctetmmcd character istics creating and sending a U>g 
file and scanning data indicated in tlie log file that has the pi edetet mined chaiacteustics fails to 
c^' 1 suggest ' the receipt of faunable icsults fiom the scanning co-piocessor " much iess 
1 processing the data uttli/tng the centtai processing unit upon the tcceipt oi fasorablc results front 
the scanning co-piocessoi inciudntg a situation wheie malicious code is not detected ' {emphasis 
added), as churned bv appellant t ieat b . a log file containing details of data w tth piedeiummed 
chaiac ten sties, as in Gutpe, sunpK fads to suggest ' the tcceipt of fasorahie results from the 
scanni ng co-pi oe essoi me hiding a situation where malicious code is not detected ' (emphasss added), 
m the mantier as claimed bv appellant. 
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Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by the 
Grape reference since all of appellant's claim limitations have not been met by the Grape reference, 
as noted above. 



Group H6: Claim 38 

The Examiner has relied on Paragraph 0036 in Grupe to make a prior art showing of appellant's 
claimed technique "wherein the criteria is further based on a user."' 



detect sucft things as virus;?:.-;, and wcrsit. However, embodiments of the above 
invention can be used to detect any content of a file that the user 
specifies. Thus, if a system administrator wishes a particular garae.? 




Appellant respectfully asserts that the excerpt from Grupe relied upon by the Examiner teaches that 
"embodiments of the above invention can be used to detect any content of a file that the user 
s pecifies "' (emphasis added). However, detecting user specified content of a file, as in Grupe, fails 
to even suggest a technique "'wherein the criteria is further based on a user " (emphasis added), as 
claimed by appellant. 

In the Examiner's Answer dated 04/27/2007. the Examiner has argued that 'Grupe discloses, 
""embodiments of the above invention can be used to detect any content of a file that the user 
specifies'" and that £ '[t jherefore, the content thai the user specifies is the criteria and since the user 
selected these criteria it is based on the user."' 

Appellant respectfully disagrees and again points out that the excerpt, from Grupe relied on by the 
Examiner merely teaches that "'embodiments of the above invention can be used to detect any 
content of a file that the user specifies" (emphasis added), in fact, the Examiner admits that :: the 
content that the user specifies is the criteria" (emphasis added). However, detecting user-specified 
content , as disclosed in Grupe, does not disclose a technique "wherein the criteria is further based on 
a user" (emphasis added), in the context claimed by appellant (see independent Claim 1 for context}. 
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Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by the 

Grape reference since all of appellant's claim limitations have not been met by the Grape reference, 
as noted above. 

Group #7; Claim 39 

The Examiner has relied on Paragraph 0036 in Gatpe to make a prior art showing of appellant's 
claimed technique "wherein the criteria is further based on software logic run by a bios." 

dor.ec" .such things viruses and wosst:; . However, embodiments of the above 
invention can be used to detect any content of a file that the user 




Appellant respectfully asserts that the excerpt from Grupe relied upon by the Examiner teaches that 
embodiments of the aho\e imurtion can be u>ed to detect am contort of a file that the use; 
specifics " However detecting uses specified content ot a file as m Giupc fails to e\en biggest d 
technique \\ heiein the cutena is blither based on soft wait; logic ran b> a ho^ t emphasis added) 
as claimed bv appellant. 

In the fvaminet^ Answer dated 04 1" 1007 the fxanunei has Unthei iched on Paiagiaph 00 1 1 of 
Giupe and lias atgued that "Grape discloses "fjbe files copied bom the souiee coiupntci nia\ be a 
complete set of files stoied on the computet i urtheu the i sarmnei has alleged that 'jtjheittote 
when all the files ate sent as a cntenon tot scanning the sottwate lo^ic that is tun b\ a bios is 
included with these files and thete*l>ie the entctta ts based on softwatc logic run bv a btos 

\ppelhmt icspectlulK disavriecs u nh the 1 viminci s alienations and asserts that now bete m the 
c\eerpts bom the cnupe terereiuc relied on bv the 1 \ammei is it disclosed that the sofhuue logic 
that i-> run bv a bio-> included w uh these ides and thetefotc the criteria ts based on sofiw ate logic 
urn b\ a bios " as alleged b\ the 1 \atmner \ppellant abseils that the evectpta ttom Gntpe tehed 
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upon In the Fvtmmet met eh disclose that * ft jhe files copied front the soutce computet nun he a 
complete set of files stoted oti the computet " ^Pdtagtaph 003 1 ) 1 fr>\\ e\ u the mete disciosuse of 
eopung a complete set of fries iiom the soutce computet as m Utupe fails to teach a technsijite 
"whetem the crttct ut is futthet baoed on software logic run b\ a hsos * (emphasis added), as claimed 
bv appellant. 

Again appellant iespeufulh asserts that appellant s specific claim latiuuaue is not anticipated b\ the 
Cuupe seference since all of appellant >. claim limitation ha\e not been met h\ the Giupe tefeience, 
as noted above. 

Group 08: Claim 44 

The fxanunei has tolled on Paragraph 001 o m Otttpe to make a ptiot ait shmuma: appellant s 
ciamred technique whet em the central ptocessmg unit aids the tannine, co-ptoccs^ot as hen a large 
amount of data is to be scanned. 

v. N ' said computer program 

product being operable to control said source computer to transmit at 
least one further flection of said data to at least one further scanning 
computer and to control said source computer to receive a log file from 
each of said at least one further scanning computers •> 



\ppjiam iespeufulh asset is that thee\ceipt iiom Utupe lehcd upon b\ the hvnmiRi teaches that 
said computer pmgr \m ptoduu being opetable to > onttoi said soutce computer to transmit at 'east 
one tuithet fraction of -.aid data to at least one tuithei Manning computer and to control said source 
computet to recuse a lug life ttom each of satd at lea>i one fuuher canning cotnputets (empha-as 
added > llo>se\ei the mete dssclosuK that the soutce computet ttatismn 0 one fuuher tt action of 
satd data to at least ^ne ttuthet scanning computer as m drupe fads to even mgAOst a technique 
wheiem the centtal piotcs^tna; unit aids the -.canning co-ptotesv-oi when a huge amount of data is 
to be scanned i emphasis added) as claimed b\ ippellam death uansnutttne a t taction of data to 
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several scanning tomputcts, a* m Giupe, laiK to suggest that the " the ctuttal pioccssmg unit aids 
ihe -=caumtiii co~ptotessoj {emphasis added) in the manner as claimed b> appellant 

in the £ ^ammei 's Answci dated 0 i 27 200", the txammei has atgued that |s]nice the souitc 
compute! has "'a computet program opeiahle to scan computet data", it is a scanning compute! ' 
1 uithei ihe 1 Aammer has Hnthet aigned that tjheieloie when the dividing a-. taught in paragraph 
t O<Uoj is petfomicd the source computet would a] .so scan a ft action of the data fit oulei to complete 
the stan durmg a slack pcuod. such as o\ u night " 

\ppeilasu lespectiuih disagrees and asset ts that nowhere m the Giupe relet cuce is u speuf'ioaSK 
disclosed thai ' w hen the di\uium as tauuht m paiagiaph 00 i t>] is perioimed ihe souue computet 
would also scan a fraction of the data as asserted bs the b samtnet 1 uithei appellant again asserts 
that the mere disclosure that the source computer transmits a timber fraction of data to at least one 
furthei scanning computet, <it> m (mtpe. Jails to e\en suggest a technique \\huein the ttntial 
piOLOssnig unit aids the scanning co-pun. essos when a huge amount of data is to bo scanned' 
(emphasis added), in the context claimed by appellant. 

Also, appellant respectfully points out that Grupe discloses "dividing the data to be scanned into 
diJTeietii ft act ions and sending each u action to a (hffeient scanning computet' when L in a suuatum 
wheie it was not possible to do a complete sean dunng a slack penod ' tPasaguph OOio emphasis 
added) Olcarlv di\ iding the data to be scanned into diffetent fractions and ^ending each traction to 
a d liferent scanning computet, as in Otupe fails tv leach a technique "whet cm the centtal 
piocessmg unit zulU the scanning co-piot.es sot when a laTge amount oJ data is to be scanned' 
(emphasis added) m the unite u claimed bs appellant 

■Again appellant lespecuulb asseits that appellant's specific claim language is not anticipated hj the 
(dupe lefeicuce >mee aH o{ appellant's tkwu limitations ha\e not been met In the Cutipe refetence 
as noted above. 

Issue #3; 
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The Examiner has rejected Claims 3, l^, 36. 41 and 43 under 35 U.S.C. 103(a) as being 
unpatentable over Grape etaS. (U.S. Publication No. 2002/0194212), in view of Zuta (International 
Publication No. WO 98/45778). 

Group #./; Claims 3, 19, and 43 

Appellant respectfully asserts that such claims have not been met by the prior art by virtue of the 
arguments made in Issue «2, Group #1 above. 

Group H2: Claim 36 

Appel l ant respectfully asserts that such c l aims have not been met by the prior ait by virtue of the 
arguments made in Issue #2, Group #5 above. 

Group #5; Claim 41 

I he txammet has telied on page 2 X hues 1 -■> m / uta to makt a puoi ait show my ot appellant s 
claimed technique "vx hetcin the scanning tontiol logic i> executed aulomaticalh w hen a computet is 
booted up. 



\ppe1lant lespecrflilK aspens, that i>uch excerpt inereK discloses that at power tip ' the contioliet 2! 
load-, hiown wtnse- pattern is welt as sensitive operations which demand tuithet NCiiitim 
t leaih luadmy a known \ nuses pattern and "sensitive opualtons which demand tin thet 
suuim\ atpo\\vi up asm /uta fail to teach a technique \vheietn the scanning coniiol logic is 
executed automatical K when a computer is booted up (emphasis added) as claimed b\ appellant 

In the I xaminei s \usv\ei dated 04 2"" 20U" the Fvmnnei has fwfhei lelied on Paiagiaph*- I and 2 
ot Pace 24 of /uta and has argued that v\ hen the s\ stem is posveied up (i e booted up) the 
contiollc! ! udo the access tr\ mtonrution to detect \ nuses and that since the monitonna means is 



-.18- 



detecting \ it uses fheieaitet dutmg notmal opctatiom the scanning logic mibt also be loaded at 
powei-np " The Pxatuttiei has fiuihet stated that 'on page <» 7 ma discloses '2 cout toller tneatu 21 
to initiate: the monitoring means .it siaa-up 1 ' and also that 'this initiating is the scanning contiol 
logic automata all\ being executed since the momtuimg means is hatdware * Appellant has 
imetpreted tin- as iciemngfo Patagtaph > oi Page So oi 7ula 

Appellant lespeelfulh disagrees and points om the Zuta tefeience meielv dtsdoses that '|a jt puwes- 
iip the eomrollci loads kno^n \ it uses pattern as well as sensim e operations (emphasis added) 
and that 1 }d juung not tail opetatton tbeieaftet it a \ uus is detected then the monitoi mg means act 
ptomptK to stop the applications ( 'PI ' but makes no mention that the scanning logic must ai-,o be 
loaded at pov>ei-up ' (anphasts added) as asserted b\ the IXammet 1 uithei appellant rioter that 
the excei pts fiom /uta on Page \<> tehed on bv the txammer meteK disclose 'eonnoilet means 
to inmate the momtormg means at start- tip ' v heic ' monitounii means evaluate ope t a turn of fust 
prote&sot m ical ttme tot detecting abnormal opeiatton" { Page lo, Paiagiaphs 4 and ^ emphasis 
added} Howewr meielv initiating moiittornig means winch c\ ahiate pioeesvvt operation at startup 
as m / uta does not esen su gg est a technique \\beiem the scanning conttol log ic is executed 
automatically w hen a computet is booted up (emphasis added) in the context claimed b\ appellant 

1 o establish a puma Ls< is case of ob\ lousness t tree basic u'lteua must be met Fu^t thete mu-.it be 
some suggestion oi motivation eithei m the teleitoees themselves oi tn the knowledge geneiallv 
available to one of ordinary »kdi m the ait ro modifv the lefetence oi to combine ufeienee 
teachings "second thete must be a tea^onable expectation oi success Fmaik the pilot attteieience 
(oi leieit'iices u hen eombmed) must teach ut suggest all the claim limitations The teaching ot 
suggestion to make the claimed combination and the reasonable expectation of success must both be 
found m the ptiot art and not ba°ed on appellant s disclosute In >t f m tJ <>J.7 f ^.d 188 20 
\ SPQ2d 1 138 (IVd ( ti 1°9{) 

\\ nk tespca to the fu st element of the pi ima facie cast of ob\ uuisnt ss and. tn particular the 
ob\ lousness of combining the afotementioned teterent-c-s, the txammet argued that it would have 
been ob\ ton-; to one of otdtnatv skill tn the art at the time oi invention to tncotpotate the ideas *>{ 
7uta with those oi Giupe and add the use of a bu« between the C PI ' of the fust computer and the 
scannmg co-piocessoi of the second computet because a bus is a commonK u^ed method ot 
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ttarKwmnu; do la belw eon two units Appellant respectful 1\ duagjees with such statement 
especial h m v lew of the \ ast e\ tdenee lo the contrai) 

in the 1: \ammei 's Ansv\ ei dated 0 i 27 200", the bxammet has aigued "that oln lonsoess can onlv he 
established b\ combining or modifsmg the teathings of the pnot an to produce the thinned 
m\ ention w hete thete oome teaching suggestion oi mom alion to do so found eithci m the 
lefesences themselves os in the knowledge genera Ih available to one of tmlinarv skill in the 
art." f he Examiner has fuithci argued that "fs]mee a bus is a commonly used method of 
ttansnmtmg data between two units this is motivation kmmn to one of oi dinars' skill m ihe att " 

Appellant respectfully disagrees and notes that Grupe "relates to data processing systems in which it 
i\ desned to Man a plus aim of compute; files to identity one ot more pi c detemn rk d c hai at ten st it s 
indicative of a computet file Iwv mg some specified content t Abstiact - emphasis added) 
Additionally ffiupe teaches thai embodiments of the invention aie paitienldih well suited to 
scanning lot a compute! \ nits'' { Paragraph 00 j 1 emphasis added) ilowevci /uta teaches that 
the approach to the computet \ mis ' wbeie ' the aunvmis pioyum scans the memon and compares 
the patterns theiein w ith stoted patterns " cieates a ' bm pi obi em smcc 1 on!\ know n v mists 
can be detected" and antrvims piogiams tannot pi event damage fiom new v hum's vvhith aie not 
included theteuf { Page "> Paragraphs ^ and ^ emphasis- added) /nt<j ai^o teache^ thai the above 
appioaeh has - [ajnothei piobiem since "the memoiv is onlv scanned ptiot to its use' and that 1 [aj 
self-changing \ uus can become active after it was scanned" (Paue 4 Paiaeiaph i emphasis 
added) lhu<:, Ziua's distlosme that aom nits piogiams cannot ptcsem damage fiom self-changing 
v u usc^ in iact h a. hi s m< ot nom using ( itupe s method ol scanning computet tiles to tdemtf\ 
ptedetet mined ehasactaistics nuheam e of a computet file having specified content It ts tmpioper 
to combine tet'eientc^ wheie the icfeiences teach awa\ fiom then combination h> t< (hawe'tu ?13 
1 2d 7 J s 7-H, 2KS L SPQ 7oQ (T\-d Cn 1 OS M 

VppJiant jespectfuih asserts that at least the fust and third dement of the puma //wt cast of 
obv lousness have not been met, since tt would be wiohwo}"* to combine the reteu-ntes, as noted 
above, and the pi soi art le+et encea w hen combined, tail to teath ot suggest aj] o{ the claim 
limitations, as noted above 



Issue #4; 



1 he I^aminei has reacted { lann M undei ^I'ST WMa) as being unpatentable o\et (mipe et al 
fl S Publication \n 2002 01^*212) m \ few of Snu\tl\ (Sna\ oh Allan Tuikon Dean 
S\nibiutic Johschedulmg ibi a Simultaneous Multnhieadrni* PioeesMir Published tn the Ptot-eedm^s 
of AS PI OS i\ No\embct 2000) 

Grow/? #/; CVaim 57 

Appellant respectfully asserts that such claims have not been met by the prior art by virtue of the 
arguments made in Issue #2, Group #5 above. 

In vieu of the remaiks Net iouh hucsnabo^e all o{ the independent claims ( ik deemed al km able 
alony with am d<inn> depending theiefiom 
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h) the esem a telephone (_otn eisafion sum! J expedttj the pioseuttion nf tins application the 
IXununes mas seaeh She undesigned at (40b) < -)71-25 7; * for pasment of anv additional fees due in 
connection with the filing of this papei, the C ommisssonci is authoH/ed to chaige such fees to 
DepoMt Account No ^0- 13M (( >rder \o N Al i P01 4) 



Respeufulh submitted 
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